I have an on-premise exchange 2016 environment.

There is an internal exchange server (on the domain) and a server in the DMZ that is not on the domain that is running the Edge Transport service.

When I run the tls check with checktls.com, I get this as the error:

SSLVersion in use: TLSv1_2
Cipher in use: ECDHE-RSA-AES256-SHA384
Certificate 1 of 1 in chain: Cert VALIDATION ERROR(S): unable to get local issuer certificate; unable to verify the first certificate
This may help: What Is An Intermediate Certificate
So email is encrypted but the recipient domain is not verified
Cert Hostname DOES NOT VERIFY (mail.company.co != COMPANYDMZ | DNS:COMPANYDMZ | DNS:COMPANYDMZ.dmz.local)
So email is encrypted but the host is not verified
cert not revoked by CRL
cert not revoked by OCSP

I am not sure what the issue actually is. I have tried creating a new certificate request on the DMZ and then requesting a cert from the root ca so it would have a verified "chain" back to the CA but I still get the same error. I have changed the edge transport cert back to the default self signed cert that came when I installed it.

The exchange server itself has a third party certificate (company.co with SANs mail.company.co and autodiscover.company.co)

Can anyone possibly shed some light on what needs to be done?

  • To be trusted by the internet at large rather than a certificate signed by your own internal CA your internet facing services need to use a certificate that has been issued by one of the well known CA’s. The certificate can and must additionally also be issued for the public host name(s) such as mail.example.com rather than your company.dmz.local internal DNS name. – HBruijn Aug 24 '18 at 14:57

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.